Personal data: personal data is any information relating to a natural person who is identified or can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to that person.
Processing of personal data: the processing of personal data includes any operation or set of operations concerning such data, whatever the process used, and in particular the collection, recording, organization, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, as well as the blocking, erasure or destruction.
Cookie: a cookie is a piece of information deposited on an Internet user’s hard disk by the server of the site he or she is visiting. It contains several pieces of information: the name of the server that placed it, a unique identifier number, and possibly an expiry date. This information is sometimes stored on the computer in a simple text file which a server accesses to read and record information.
1.2 DATA CONTROLLER
The company responsible for processing the personal data referred to herein is Balea, registered in the Montpellier Trade and Companies Register under no. 340 024 973, whose registered office is located at 8 Avenue du Grand Chêne – 34270 Saint Mathieu de Tréviers – France and represented by Mr. Vassili COSMAS.
1.3 DATA COLLECTED
1.3.1 DATA COLLECTED ON THE SITE
When the user uses the contact form, Balea collects and processes the following data:
When the user uses the recruitment form, Balea collects and processes the following data:
The compulsory or optional nature of the data is indicated at the time of collection by an asterisk.
In addition, certain data is collected automatically as a result of the user’s actions on the site (see paragraph on cookies).
1.3.2 DATA COLLECTED AS PART OF THE CONTRACTUAL RELATIONSHIP BETWEEN BALEA AND THE CUSTOMER
As part of the contractual relationship between Balea and the customer, Balea collects and processes the following data: surname, first names, address, telephone number (landline or mobile), fax number, e-mail address, position within the company.
Balea undertakes to request only the data strictly necessary to process the file.
Balea’s services and the hosting of the data collected are established in France.
1.4 DATA RECIPIENTS
The communications and sales departments are the recipients of the following data: surname, first name, company name and position if applicable, postal address, e-mail address.
The accounting department is the recipient of the following data: surname, first name, e-mail, company name if applicable, postal address.
The recruitment department receives the following data: surname, first name, email address, curriculum vitae and covering letter.
Balea undertakes not to sell or rent the data collected.
Personal data provided may only be disclosed to third parties in the following cases:
With the authorization of the data owner.
At the request of the legally competent authorities, upon judicial requisition, or in the context of legal proceedings.
1.5 PURPOSES – LEGAL BASIS FOR PROCESSING
The processing of personal data is necessary for the performance of the services of the Balea company or for the performance of pre-contractual measures taken at the request of the data subject.
It is based on Article 6, paragraph 1, point b of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016.
The purposes are as follows concerning the contact form:
The preparation of quotations and contracts;
Commercial and accounting management of the contract;
The management of prospecting operations.
The recruitment form is used for the following purposes:
The purposes of the personal rights form are as follows:
Management of requests to exercise the rights of the persons concerned.
1.6 DATA RETENTION PERIOD
Data relating to the follow-up of the commercial relationship and the payment of invoices are kept in the active database until the end of the commercial relationship between the parties, then in an archive database for a period of 5 years from the end of the commercial relationship.
Personal data relating to prospective customers is kept for a period of 3 years from the date of collection by the data controller, or from the last contact from the prospective customer in the case of data relating to the latter.Personal data relating to job applications is kept for a period of 2 years from the date of collection by the data controller, or from the last contact with the applicant in the case of data relating to the latter.At the end of this period, unless consent is obtained for a longer period, the data will be archived for the legal period of limitation before final destruction.
Personal data relating to a request to exercise a person’s rights is kept for a period of 10 years from the date of collection by the data controller.
1.7 RIGHTS OF HOLDERS OF PERSONAL DATA
Persons whose personal data is collected have the right to access their personal data, to have it corrected or deleted, to limit processing, to have data portability, and to object to processing.
The Customer is informed, however, that the personal data collected is necessary for the performance of the Service, so that if he exercises his right to erase, oppose or limit the processing of said data before the end of the contractual relationship, the Service cannot be performed.
These rights may be exercised by filling in the online “personal rights” form, or by post by printing out this form.Balea will reply to any person who has exercised one of the aforementioned rights within one month of receipt of the request.
However, this period may be extended by two months, depending on the complexity and number of requests. In this case, Balea will inform the person concerned of the extension within one month of receipt of the request.
Where the data subject’s request is in electronic form, the information is provided electronically where possible, unless the data subject requests otherwise.
If the data controller refuses to comply with the data subject’s request for information, he or she shall state the reasons for the refusal.
The data subject has the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés or the supervisory authority of the European Union member state in which he or she resides, and to take legal action.
Right of access:
Any data subject may request confirmation from the controller as to whether or not personal data concerning him or her are being processed.
If so, the data subject may obtain a copy of the personal data being processed, together with the following information:
Purposes of processing ;
Categories of personal data concerned;
Recipients or categories of recipients of the data;Where possible, the intended data retention period or, where this is not possible, the criteria used to determine this period;
Where personal data is not collected from the data subject, any available information as to its source;
Where applicable, the existence of automated decision-making, including profiling, and relevant information concerning the underlying logic, as well as the significance and anticipated consequences of such processing for the data subject.
The controller may require payment of a reasonable fee based on administrative costs for any additional copies requested (Article 15.3 of the GDPR).
In the event of manifestly unfounded or excessive requests, the data controller may require the payment of reasonable fees that take into account the administrative costs incurred in providing the information or refuse to comply with such requests (Article 12.5 of the GDPR).
Right of rectification:
Any person whose personal data is processed has the right to obtain the rectification of personal data concerning them that is inaccurate and that such data be completed if the purpose of the processing so requires where applicable.
Right to erasure:
Any person whose personal data is processed has the right to obtain from the data controller the erasure of said data in the following cases:
When the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
Where the data subject has withdrawn the consent on which the processing was based and there is no other legal basis for the processing;
Where processing is based on the legitimate interests of the data controller, where the data subject has objected to the processing and there is no compelling legitimate reason for the processing;
In the event that the purpose of the processing is canvassing or profiling in connection with such canvassing, where the data subject has objected to the processing;
Where personal data has been processed unlawfully;
when personal data must be erased to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject;
In certain cases, however, the data controller may refuse to erase the data:
To comply with a legal obligation that requires the data to be processed in accordance with EU or French law;
When the sole purpose of processing is statistical;Where processing is necessary for the establishment, exercise or defense of legal claims.
Right to limitation:
Any person whose personal data is processed may ask the data controller to limit the processing in the following cases:
When he/she disputes the accuracy of his/her personal data, for a period allowing the data controller to verify the accuracy of said data;
When the processing does not comply with the regulations, but the data controller does not wish to erase the data;
When the data controller no longer needs the personal data for processing purposes, but the data is still required by the user for the establishment, exercise or defense of legal claims;
Where the data subject has objected to the processing, during verification as to whether the legitimate grounds pursued by the controller override those of the data subject.
Where processing has been restricted, with the exception of storage, data may only be processed in the following cases:
With the consent of the data subject,
For the establishment, exercise or defense of legal claims,
to protect the rights of another natural or legal person, or for important reasons of public interest of the Union or a Member State.
If the limitation were subsequently to be lifted, the data controller would inform the data subject in advance.
Right to portability:
Any person whose personal data is the subject of processing may request the data controller to communicate the data to him or her, or to transmit it to another data controller, in the following cases:
Where processing has been carried out in response to the consent of the data subject.
Where processing is necessary for the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures taken at the data subject’s request.
Where the processing is carried out using automated processes.
Right to object:
Any person whose personal data is processed has the right to object to such processing under the following conditions:
Where the processing is based on the satisfaction of legitimate interests pursued by the data controller or by a third party, for reasons relating to his or her particular situation and if the data controller does not demonstrate that there are legitimate and compelling grounds for the processing overriding the interests and rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.
When processing is carried out for the purposes of canvassing or profiling in connection with such canvassing, the individual may unconditionally object to such processing.
When processing is carried out for statistical purposes, for reasons relating to the individual’s particular situation.
1.8 DATA STORAGE LOCATION
The hosting servers on which Balea processes and stores the databases are located exclusively in the European Union.
1.9 COMPLAINTS TO A SUPERVISORY AUTHORITY
Any person whose personal data is processed may lodge a complaint relating to the processing of data concerning him or her with the CNIL or the supervisory authority of the European Union member state in which he or she resides.